This is an automated email from the ASF dual-hosted git repository.
zstan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ignite.git
The following commit(s) were added to refs/heads/master by this push:
new 65a574d63bf IGNITE-29051 Several tests from JdbcThinConnectionSSLTest
are failed locally (#13578)
65a574d63bf is described below
commit 65a574d63bf479434c940ed0677132e3e4764885
Author: Evgeniy Stanilovskiy <[email protected]>
AuthorDate: Tue Sep 15 08:36:26 2026 +0300
IGNITE-29051 Several tests from JdbcThinConnectionSSLTest are failed
locally (#13578)
---
.../jdbc/thin/JdbcThinConnectionSSLTest.java | 69 +++++++++++++++++++---
1 file changed, 62 insertions(+), 7 deletions(-)
diff --git
a/modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java
b/modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java
index 3e2bb1d41b2..c97fbe55911 100644
---
a/modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java
+++
b/modules/clients/src/test/java/org/apache/ignite/jdbc/thin/JdbcThinConnectionSSLTest.java
@@ -23,6 +23,9 @@ import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
import java.util.concurrent.Callable;
import javax.cache.configuration.Factory;
import javax.net.ssl.SSLContext;
@@ -333,15 +336,19 @@ public class JdbcThinConnectionSSLTest extends
JdbcThinAbstractSelfTest {
*/
@Test
public void testDisabledCustomCipher() throws Exception {
+ String disabledSuite =
disabledByDefaultCipherSuites().iterator().next();
+
+ System.out.println("Run test with cipher suite: " + disabledSuite);
+
setSslCtxFactoryToCli = true;
- supportedCiphers = new String[] {"TLS_RSA_WITH_NULL_SHA256" /*
Disabled by default */};
+ supportedCiphers = new String[] {disabledSuite /* Disabled by default
*/};
sslCtxFactory = getTestSslContextFactory();
startGrids(1);
try {
// Explicit supported ciphers.
try (Connection conn =
DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
- "&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
+ "&sslCipherSuites=" + disabledSuite +
"&sslTrustAll=true" +
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
"&sslClientCertificateKeyStorePassword=123456" +
@@ -350,9 +357,30 @@ public class JdbcThinConnectionSSLTest extends
JdbcThinAbstractSelfTest {
checkConnection(conn);
}
- // Default ciphers.
+ //completely disabled jdk 17+
+
+ //DES (56-bit):
+ //TLS_RSA_WITH_DES_CBC_SHA, TLS_DHE_RSA_WITH_DES_CBC_SHA,
+ // TLS_DHE_DSS_WITH_DES_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_DES_CBC_SHA,
+ // TLS_ECDHE_RSA_WITH_DES_CBC_SHA,
TLS_ECDHE_PSK_WITH_DES_CBC_SHA,
+ // TLS_ECDH_ECDSA_WITH_DES_CBC_SHA,
TLS_ECDH_RSA_WITH_DES_CBC_SHA,
+ // TLS_ECDH_anon_WITH_DES_CBC_SHA
+
+ //3DES/DESede:
+ //TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
+ // TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
+ // TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+ // TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
+ // TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
+
+ String completelyDisabledSuite = "TLS_RSA_WITH_DES_CBC_SHA";
+
+
assertFalse(Set.of(factory("TLS").getSupportedCipherSuites()).contains(completelyDisabledSuite));
+
+ // Java 17+, the cipher suite TLS_RSA_WITH_NULL_SHA256 is
completely disabled by default.
GridTestUtils.assertThrows(log, () -> {
return
DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
+ "&sslCipherSuites=" + completelyDisabledSuite +
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
"&sslClientCertificateKeyStorePassword=123456" +
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
@@ -372,10 +400,12 @@ public class JdbcThinConnectionSSLTest extends
JdbcThinAbstractSelfTest {
*/
@Test
public void testUnsupportedCustomCipher() throws Exception {
+ String disabledSuite =
disabledByDefaultCipherSuites().iterator().next();
+
setSslCtxFactoryToCli = true;
supportedCiphers = new String[] {
- "TLS_RSA_WITH_NULL_SHA256" /* Disabled by default */,
- "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" /* With disabled protocol*/};
+ disabledSuite /* Supported by JDK */,
+ "TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA" /* Anonymous cipher is
disabled by default */};
sslCtxFactory = getTestSslContextFactory();
startGrids(1);
@@ -393,7 +423,7 @@ public class JdbcThinConnectionSSLTest extends
JdbcThinAbstractSelfTest {
// Supported cipher.
try (Connection conn =
DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
- "&sslCipherSuites=TLS_RSA_WITH_NULL_SHA256" +
+ "&sslCipherSuites=" + disabledSuite +
"&sslTrustAll=true" +
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
"&sslClientCertificateKeyStorePassword=123456" +
@@ -403,6 +433,7 @@ public class JdbcThinConnectionSSLTest extends
JdbcThinAbstractSelfTest {
}
// Default ciphers.
+ // Behavior can be different for local and TC runs due to
different: java.security settings
GridTestUtils.assertThrows(log, () -> {
return
DriverManager.getConnection("jdbc:ignite:thin://127.0.0.1/?sslMode=require" +
"&sslClientCertificateKeyStoreUrl=" + CLI_KEY_STORE_PATH +
@@ -410,7 +441,6 @@ public class JdbcThinConnectionSSLTest extends
JdbcThinAbstractSelfTest {
"&sslTrustCertificateKeyStoreUrl=" + TRUST_KEY_STORE_PATH +
"&sslTrustCertificateKeyStorePassword=123456");
}, SQLException.class, "Failed to SSL connect to server");
-
}
finally {
stopAllGrids();
@@ -723,4 +753,29 @@ public class JdbcThinConnectionSSLTest extends
JdbcThinAbstractSelfTest {
return getTestSslContextFactory().create().getSocketFactory();
}
}
+
+ /** */
+ private SSLSocketFactory factory(String protocol) throws Exception {
+ SSLContext ctx = SSLContext.getInstance(protocol);
+ ctx.init(null, null, null);
+
+ return ctx.getSocketFactory();
+ }
+
+ /** */
+ private Set<String> disabledByDefaultCipherSuites() throws Exception {
+ SSLSocketFactory factory = factory("TLSv1.2");
+
+ Set<String> supportedCiphersSuites = new
HashSet<>(Arrays.stream(factory.getSupportedCipherSuites()).toList());
+
+ // Fulter supported, but NOT in the default active list.
+
supportedCiphersSuites.removeAll(Set.of(factory.getDefaultCipherSuites()));
+
+ // Current TC settings.
+ supportedCiphersSuites.removeIf(s -> s.contains("_anon_"));
+
+ assertFalse("No one disabled by default suite found",
supportedCiphersSuites.isEmpty());
+
+ return supportedCiphersSuites;
+ }
}
